fix(telemetry): use span name constants and fix cardinality risk

- Use grpc_span::val::resourceExhausted constant instead of raw
  "resource_exhausted" string in GRPCServer.cpp
- Fix unbounded span name cardinality in RPCHandler.cpp error path:
  use fixed rpc_span::val::unknownCommand as span name instead of
  user-supplied cmdName (attacker-controlled input). The actual
  command is still captured in the xrpl.rpc.command attribute.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/xrpld/app/main/GRPCServer.cpp

@@ -1,7 +1,7 @@
 #include <xrpld/app/main/GRPCServer.h>
-#include <xrpld/app/main/GrpcSpanNames.h>
 
 #include <xrpld/app/main/Application.h>
+#include <xrpld/app/main/GrpcSpanNames.h>
 #include <xrpld/core/ConfigSections.h>
 #include <xrpld/rpc/Context.h>
 #include <xrpld/rpc/GRPCHandlers.h>
@@ -178,7 +178,7 @@ GRPCServerImpl::CallData<Request, Response>::process(std::shared_ptr<JobQueue::C
         bool const isUnlimited = clientIsUnlimited();
         if (!isUnlimited && usage.disconnect(app_.getJournal("gRPCServer")))
         {
-            span.setError("resource_exhausted");
+            span.setError(grpc_span::val::resourceExhausted);
             grpc::Status const status{
                 grpc::StatusCode::RESOURCE_EXHAUSTED, "usage balance exceeds threshold"};
             responder_.FinishWithError(status, this);

src/xrpld/rpc/detail/RPCHandler.cpp

@@ -216,7 +216,8 @@ doCommand(RPC::JsonContext& context, Json::Value& result)
             ? context.params[jss::command].asString()
             : context.params.isMember(jss::method) ? context.params[jss::method].asString()
                                                    : "unknown";
-        auto span = SpanGuard::span(TraceCategory::Rpc, rpc_span::prefix::command, cmdName);
+        auto span = SpanGuard::span(
+            TraceCategory::Rpc, rpc_span::prefix::command, rpc_span::val::unknownCommand);
         span.setAttribute(rpc_span::attr::command, cmdName.c_str());
         span.setError(get_error_info(error).token.c_str());
 

src/xrpld/rpc/detail/RpcSpanNames.h

@@ -157,6 +157,7 @@ using telemetry::attr_val::error;
 using telemetry::attr_val::success;
 inline constexpr auto admin = makeStr("admin");
 inline constexpr auto user = makeStr("user");
+inline constexpr auto unknownCommand = makeStr("unknown");
 }  // namespace val
 
 }  // namespace rpc_span